Self-Hosting

I finally started using Molly to send and receive messages via Signal. Molly is a hardened fork of Signal for Android, offering features such as an encrypted message database, automatic locking, shredding no longer needed secrets from RAM, notifications via UnifiedPush, and Tor / SOCKS proxy support. This is by no means an alternative to Signal itself, but rather an alternative (and hardened) Android client for Signal. While these extra security features are great, my main motivation to use Molly was battery saving, actually. I’m on GrapheneOS, which does offer sandboxed Google Play (opt-in), yet I’ve chosen not to use it. This means I’m not using Google’s Firebase Cloud Messaging (FCM) for notifications either, which Signal by default heavily relies on. However, it continues to make me very glad I can still use a secure and open source mobile operating system (GrapheneOS) in 2025, without needing to rely on proprietary and privacy-impairing functionality. ...

OpenWrt is an open source Linux project aimed at embedded devices to route network traffic (e.g. routers). I’ve consistently run OpenWrt on my home routers for over a decade now (I still remember the brief LEDE split), and it has since been my preferred home router OS. While I’ve also wanted to experiment with OPNsense (and pfSense before), I’ve never had a real reason to thus far, but I digress…​ It might be interesting to add some network security such as intrusion prevention to your residential gateway directly. You might of old be familiar with Fail2Ban, and I’ve happily used Fail2Ban for years. CrowdSec is a similar solution, albeit more community-driven. Klaus Agnoletti, then (still?) head of community at CrowdSec, summarised the similarities and differences between the two: ...

Some time ago I documented how I configured WireGuard on my OpenWrt router at home, to connect securely to my home network (and the Internet, really) from wherever I am. I feel safer connecting to public Wi-Fi this way, also abroad when it allows me to save extra roaming costs. However, during my travels I sometimes come across networks which seem to block VPN connections, sometimes including my own personal WireGuard tunnel. For such cases I managed to tunnel my WireGuard connection over HTTPS, which is typically (far) less often blocked. ...

My previous post discussed how to get a headless Steam instance running on TrueNAS SCALE. I had a spare GPU which I wanted to repurpose to play (older) video games without first needing to boot my desktop. This post roughly documents how I run my Home Assistant instance on my TrueNAS SCALE server. The official website details several installation methods, which mainly comes down to two installation types: either a full-fledged OS image (HA OS), or; a (less feature-complete) containerised version. ...

After watching Lawrence Systems' video about why it’s time to move off TrueNAS CORE—​which I had been putting off for too long already—​I finally migrated to Community (SCALE). I guess it was the last push I needed, really. I even migrated most of my services inside my VMs to either separate TrueNAS Apps, or vanilla docker containers I manage via Dockge (such as Nextcloud AIO). But then I also noticed another available TrueNAS App which piqued my interest: Steam Headless. ...

This post briefly describes how to configure an OpenWrt router to function as a WireGuard VPN server. This enables me to have my phone always be securely connected to my home router, from wherever I am. This is what it roughly looks like: First, install the necessary WireGuard kernel module: root # opkg update root # opkg install kmod-wiregard Generate a new private and public key pair for the server, and your first peer (e.g. your phone), and a pre-shared key for added post-quantum secrecy: ...